CVE-2007-4044 (GCVE-0-2007-4044)

Vulnerability from cvelistv5 – Published: 2007-07-27 22:00 – Updated: 2007-08-22 09:00
VLAI?

The MS-RPC functionality in smbd in Samba 3 on SUSE Linux before 20070720 does not include "one character in the shell escape handling." NOTE: this issue was originally characterized as a shell metacharacter issue due to an incomplete fix for CVE-2007-2447, which was interpreted by CVE to be security relevant. However, SUSE and Red Hat have disputed the problem, stating that the only impact is that scripts will not be executed if they have a "c" in their name, but even this limitation might not exist. This does not have security implications, so should not be included in CVE

Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2007-08-22T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "The MS-RPC functionality in smbd in Samba 3 on SUSE Linux before 20070720 does not include \"one character in the shell escape handling.\"  NOTE: this issue was originally characterized as a shell metacharacter issue due to an incomplete fix for CVE-2007-2447, which was interpreted by CVE to be security relevant.  However, SUSE and Red Hat have disputed the problem, stating that the only impact is that scripts will not be executed if they have a \"c\" in their name, but even this limitation might not exist.  This does not have security implications, so should not be included in CVE"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4044",
    "datePublished": "2007-07-27T22:00:00",
    "dateRejected": "2007-08-22T09:00:00",
    "dateReserved": "2007-07-27T00:00:00",
    "dateUpdated": "2007-08-22T09:00:00",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Rejected reason: The MS-RPC functionality in smbd in Samba 3 on SUSE Linux before 20070720 does not include \\\"one character in the shell escape handling.\\\"  NOTE: this issue was originally characterized as a shell metacharacter issue due to an incomplete fix for CVE-2007-2447, which was interpreted by CVE to be security relevant.  However, SUSE and Red Hat have disputed the problem, stating that the only impact is that scripts will not be executed if they have a \\\"c\\\" in their name, but even this limitation might not exist.  This does not have security implications, so should not be included in CVE\"}]",
      "id": "CVE-2007-4044",
      "lastModified": "2023-11-07T02:00:58.140",
      "published": "2007-07-27T22:30:00.000",
      "sourceIdentifier": "cve@mitre.org",
      "vendorComments": "[{\"organization\": \"Red Hat\", \"comment\": \"The CVE description for this bug is incorrect.    The backported patch for CVE-2007-2447 missed the character \\u2019c\\u2019 in the shell escaping whitelist of allowed characters, therefore not allowing commands with a \\u2019c\\u2019 in them to be executed.  This is therefore a regression bug and not a security vulnerability.\", \"lastModified\": \"2007-08-17T00:00:00\"}]",
      "vulnStatus": "Rejected"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2007-4044\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2007-07-27T22:30:00.000\",\"lastModified\":\"2023-11-07T02:00:58.140\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: The MS-RPC functionality in smbd in Samba 3 on SUSE Linux before 20070720 does not include \\\"one character in the shell escape handling.\\\"  NOTE: this issue was originally characterized as a shell metacharacter issue due to an incomplete fix for CVE-2007-2447, which was interpreted by CVE to be security relevant.  However, SUSE and Red Hat have disputed the problem, stating that the only impact is that scripts will not be executed if they have a \\\"c\\\" in their name, but even this limitation might not exist.  This does not have security implications, so should not be included in CVE\"}],\"metrics\":{},\"references\":[],\"vendorComments\":[{\"organization\":\"Red Hat\",\"comment\":\"The CVE description for this bug is incorrect.    The backported patch for CVE-2007-2447 missed the character \u2019c\u2019 in the shell escaping whitelist of allowed characters, therefore not allowing commands with a \u2019c\u2019 in them to be executed.  This is therefore a regression bug and not a security vulnerability.\",\"lastModified\":\"2007-08-17T00:00:00\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.